[PATCH v2] tests/keys: skip KEYCTL_DH_COMPUTE when unavailable

[Pablo Alessandro Santos Hugen <phugen@redhat.com>]

Since 32f07cc40c9b ("crypto: dh - disallow plain "dh" usage in
FIPS mode") landed in linux 5.18, plain "dh" is disallowed in
FIPS mode per SP800-56Arev3. keyctl(KEYCTL_DH_COMPUTE) returns
ENOENT in FIPS mode.

Treat ENOENT and EOPNOTSUPP as non-fatal in keyctl.c and
request_keys.c (the operation is unavailable, not denied by
policy). SELinux denials (EACCES) still exit 9/8.

Fixes: 2d7aad8a1f8c ("selinux-testsuite: Add keys tests")
Signed-off-by: Pablo Alessandro Santos Hugen <phugen@redhat.com>
---
Changes in v2 (Stephen Smalley):
 - Replace ENOSYS with EOPNOTSUPP — KEYCTL_DH_COMPUTE never
   returns ENOSYS; the !CONFIG_KEY_DH_OPERATIONS stub returns
   EOPNOTSUPP
 - Drop SKIP blocks in Perl test — SELinux denial fires before
   DH computation (EACCES -> ENOKEY), so no_read_t tests still
   pass under FIPS

 tests/keys/keyctl.c       | 15 ++++++++++-----
 tests/keys/request_keys.c | 15 ++++++++++-----
 2 files changed, 20 insertions(+), 10 deletions(-)

diff --git a/tests/keys/keyctl.c b/tests/keys/keyctl.c
index e13c655..5e98f11 100644
--- a/tests/keys/keyctl.c
+++ b/tests/keys/keyctl.c
@@ -142,12 +142,17 @@ int main(int argc, char *argv[])
 	/* Requires key { create read write } */
 	compute = keyctl(KEYCTL_DH_COMPUTE, &params, NULL, 0, 0);
 	if (compute < 0) {
-		fprintf(stderr, "Failed KEYCTL_DH_COMPUTE: %s\n",
-			strerror(errno));
-		exit(9);
-	}
-	if (verbose)
+		if (errno == ENOENT || errno == EOPNOTSUPP) {
+			if (verbose)
+				printf("KEYCTL_DH_COMPUTE not available, skipping\n");
+		} else {
+			fprintf(stderr, "Failed KEYCTL_DH_COMPUTE: %s\n",
+				strerror(errno));
+			exit(9);
+		}
+	} else if (verbose) {
 		printf("KEYCTL_DH_COMPUTE key ID size: %d\n", compute);
+	}
 
 	/* Requires key { write link } */
 	link = keyctl(KEYCTL_LINK, base, KEY_SPEC_PROCESS_KEYRING);
diff --git a/tests/keys/request_keys.c b/tests/keys/request_keys.c
index 43b20d9..291a522 100644
--- a/tests/keys/request_keys.c
+++ b/tests/keys/request_keys.c
@@ -127,12 +127,17 @@ int main(int argc, char **argv)
 	/* Requires key { read write } */
 	compute = keyctl(KEYCTL_DH_COMPUTE, &params, NULL, 0, 0);
 	if (compute < 0) {
-		fprintf(stderr, "Failed KEYCTL_DH_COMPUTE: %s\n",
-			strerror(errno));
-		exit(8);
-	}
-	if (verbose)
+		if (errno == ENOENT || errno == EOPNOTSUPP) {
+			if (verbose)
+				printf("\tKEYCTL_DH_COMPUTE not available, skipping\n");
+		} else {
+			fprintf(stderr, "Failed KEYCTL_DH_COMPUTE: %s\n",
+				strerror(errno));
+			exit(8);
+		}
+	} else if (verbose) {
 		printf("\tKEYCTL_DH_COMPUTE key ID size: %d\n", compute);
+	}
 
 	exit(0);
 }
-- 
2.56.0